This Consumer Health Data Privacy Policy is required by Washington's My Health My Data Act and similar laws (Nevada SB370, Connecticut), and it applies to everyone who uses Shape — not just Washington residents. It sits alongside our general Privacy Policy; where they overlap, this policy governs consumer health data.
Scope & who this covers
"Consumer health data" means personal information that identifies your past, present, or future physical or mental health status. Shape is a consumer fitness and coaching platform; the trainers and nutritionists on Shape are independent professionals, not your medical providers. The health information you enter here is therefore consumer health data — not "Protected Health Information" under HIPAA — and HIPAA generally does not apply. We nonetheless treat it as sensitive and protect it as described below. Shape ("we," "our") is the entity that determines how this data is processed.
Health data we collect
Only what you choose to provide or connect, for coaching and safety:
- Health & safety screening: PAR-Q answers; prescription medications; allergies; pregnancy or postpartum status; ongoing medical conditions; injuries and surgeries; and an emergency contact.
- Body & progress: weight, body-fat percentage, girth measurements, and progress photos.
- Activity & recovery: heart rate, heart-rate variability, sleep, resting heart rate, recovery, workout minutes, and training logs.
- Nutrition: meal logs, calories and macros, recorded voice meal-notes, and grocery lists.
- Weekly check-ins: your ratings of sleep, energy, stress, hunger, and adherence.
- Goals: body-composition targets and the reasons behind them.
- Connected sources: data from any wearable or health app you choose to connect (see Section 03).
Where it comes from
Directly from you (what you type, upload, or record); from devices and apps you choose to connect — Apple Health, Strava, Garmin, Whoop, Oura — pulling only the metrics you authorize at each connection; and generated within Shape as you use it (for example, your Shape Score or a coaching summary).
How we use it
- To deliver coaching — sharing relevant data with the specific coach(es) you link with so they can program safely and effectively.
- To run the features you use — logging, progress tracking, check-ins, your Shape Score, and the "Nora" assistant and voice features (which are powered by OpenAI and may receive health and fitness context to generate your response).
- To keep you safe — surfacing your safety screening to a linked coach.
- To secure the platform and meet legal obligations.
We do not use your consumer health data for advertising, to build advertising profiles, or to train artificial-intelligence models, and we do not sell it.
Consent
We ask for your consent before we collect consumer health data, and a separate consent before we share it beyond what is necessary to provide a feature you have asked for. Each consent is specific, optional, and described in plain language at the point we ask for it, and you can withdraw any consent at any time by emailing privacy@theshapecommunity.com (and you can disconnect a connected app or delete your account directly in Settings) — withdrawing applies going forward and does not affect processing already carried out.
No sale of health data
Shape does not sell your consumer health data, and we do not exchange it for anything of value. We would not sell it without first obtaining your valid, written authorization that meets the specific requirements of the My Health My Data Act — and we have no plans to do so.
Your rights
You have the right to:
- Confirm and access the consumer health data we have about you, including a list of the third parties and processors with whom we have shared it.
- Withdraw consent to our collection or sharing of it.
- Delete it. When you ask us to delete your consumer health data, we delete it from our systems and our storage and direct our processors to do the same. Deletion of consumer health data is not subject to the broad legal-retention exceptions that can apply to other records.
To exercise any of these, use our privacy request form, export or delete your data directly in Settings, or email privacy@theshapecommunity.com. We verify your identity proportionately and respond within the time the applicable law requires. If we deny a request, you may appeal by replying to our response; if an appeal is denied, you may contact your state attorney general.
Security & who can access it
Consumer health data is protected with per-user, row-level access controls, encryption in transit and at rest, and private storage served only through short-lived signed URLs. Access is limited to the people and processors who need it to provide the service to you: the coach(es) you link with, the processors listed on our Subprocessors page, and the minimum number of Shape personnel required to operate and support the platform — each under confidentiality obligations.
No geofencing
Shape does not use geofences around any healthcare facility, and does not use location to identify or track your visits to such places or to send you related messages.
Changes & contact
If we materially change how we handle consumer health data, we will update this page and the "Last updated" date and give notice as described in our Privacy Policy. Questions, requests, or security reports: privacy@theshapecommunity.com.